AUTO2, a saturation-based heuristic prover for higher-order logic Bohua Zhan Massachusetts Institute of Technology bzhan@mit.edu August 23, 2016 Bohua Zhan (MIT) AUTO2, a saturation-based heuristic prover August 23, 2016 1 / 27
Table of Contents Motivation 1 Overall architecture 2 Details 3 Case analysis E-matching Proof steps Proof scripts Case studies 4 Future work and conclusion 5 Bohua Zhan (MIT) AUTO2, a saturation-based heuristic prover August 23, 2016 2 / 27
Motivation With the increasing depth and complexity of proofs, automation in interactive theorem provers becomes ever more important. Bohua Zhan (MIT) AUTO2, a saturation-based heuristic prover August 23, 2016 3 / 27
Motivation With the increasing depth and complexity of proofs, automation in interactive theorem provers becomes ever more important. Despite enormous progress, computers still cannot prove many statements that humans consider to be routine. Bohua Zhan (MIT) AUTO2, a saturation-based heuristic prover August 23, 2016 3 / 27
Motivation With the increasing depth and complexity of proofs, automation in interactive theorem provers becomes ever more important. Despite enormous progress, computers still cannot prove many statements that humans consider to be routine. Obstacle to both the QED project (formalization of mathematics) and more widespread adoption of formal software verification. Bohua Zhan (MIT) AUTO2, a saturation-based heuristic prover August 23, 2016 3 / 27
Motivation auto2 : a new approach to automation that combines the best features of tactics and SMT. Bohua Zhan (MIT) AUTO2, a saturation-based heuristic prover August 23, 2016 4 / 27
Motivation auto2 : a new approach to automation that combines the best features of tactics and SMT. From the tactics framework: ◮ Incorporate heuristics that humans use when proving theorems. ◮ Make it easy for users to add new heuristics while maintaining soundness (LCF architecture). ◮ Work with higher order logic and (simple) types. Bohua Zhan (MIT) AUTO2, a saturation-based heuristic prover August 23, 2016 4 / 27
Motivation auto2 : a new approach to automation that combines the best features of tactics and SMT. From the tactics framework: ◮ Incorporate heuristics that humans use when proving theorems. ◮ Make it easy for users to add new heuristics while maintaining soundness (LCF architecture). ◮ Work with higher order logic and (simple) types. From SMT: ◮ Have a robust search mechanism. Bohua Zhan (MIT) AUTO2, a saturation-based heuristic prover August 23, 2016 4 / 27
Motivation auto2 : a new approach to automation that combines the best features of tactics and SMT. From the tactics framework: ◮ Incorporate heuristics that humans use when proving theorems. ◮ Make it easy for users to add new heuristics while maintaining soundness (LCF architecture). ◮ Work with higher order logic and (simple) types. From SMT: ◮ Have a robust search mechanism. auto2 is not designed to: ◮ Be fully automatic. ◮ Have good completeness properties. Bohua Zhan (MIT) AUTO2, a saturation-based heuristic prover August 23, 2016 4 / 27
Table of Contents Motivation 1 Overall architecture 2 Details 3 Case analysis E-matching Proof steps Proof scripts Case studies 4 Future work and conclusion 5 Bohua Zhan (MIT) AUTO2, a saturation-based heuristic prover August 23, 2016 5 / 27
Overall architecture Implemented in Isabelle/ML, using Isabelle/HOL as base logic. Bohua Zhan (MIT) AUTO2, a saturation-based heuristic prover August 23, 2016 6 / 27
Overall architecture Implemented in Isabelle/ML, using Isabelle/HOL as base logic. Transform input problem into contradiction form: [ A 1 , A 2 , . . . , A n ] = ⇒ C becomes [ A 1 , A 2 , . . . , A n , ¬ C ] = ⇒ False . Bohua Zhan (MIT) AUTO2, a saturation-based heuristic prover August 23, 2016 6 / 27
Overall architecture Implemented in Isabelle/ML, using Isabelle/HOL as base logic. Transform input problem into contradiction form: [ A 1 , A 2 , . . . , A n ] = ⇒ C becomes [ A 1 , A 2 , . . . , A n , ¬ C ] = ⇒ False . Important: Previously proved theorems are not among the assumptions. ◮ Instead they are encoded into set of allowed actions. Bohua Zhan (MIT) AUTO2, a saturation-based heuristic prover August 23, 2016 6 / 27
Overall architecture Saturation based: maintain a list of items — facts derived from the initial assumptions. This list is initially A 1 , . . . , A n , ¬ C . Bohua Zhan (MIT) AUTO2, a saturation-based heuristic prover August 23, 2016 7 / 27
Overall architecture Saturation based: maintain a list of items — facts derived from the initial assumptions. This list is initially A 1 , . . . , A n , ¬ C . New items are generated from existing ones using proof steps . Proof steps are ML functions that accept as input one or two existing items, and output (among other possibilities) a list of items that logically follow from the input items. Bohua Zhan (MIT) AUTO2, a saturation-based heuristic prover August 23, 2016 7 / 27
Overall architecture Saturation based: maintain a list of items — facts derived from the initial assumptions. This list is initially A 1 , . . . , A n , ¬ C . New items are generated from existing ones using proof steps . Proof steps are ML functions that accept as input one or two existing items, and output (among other possibilities) a list of items that logically follow from the input items. Best-first search: each item is assigned a score . New items are put into a priority queue, and are inserted into the main list (and considered by proof steps) in order of their score. Bohua Zhan (MIT) AUTO2, a saturation-based heuristic prover August 23, 2016 7 / 27
Overall architecture Saturation based: maintain a list of items — facts derived from the initial assumptions. This list is initially A 1 , . . . , A n , ¬ C . New items are generated from existing ones using proof steps . Proof steps are ML functions that accept as input one or two existing items, and output (among other possibilities) a list of items that logically follow from the input items. Best-first search: each item is assigned a score . New items are put into a priority queue, and are inserted into the main list (and considered by proof steps) in order of their score. Algorithm ends when False is derived, or when there are no more items waiting to be processed, or if a timeout condition is reached. Bohua Zhan (MIT) AUTO2, a saturation-based heuristic prover August 23, 2016 7 / 27
A simple example Given an infinite sequence X = ( X 0 , X 1 , X 2 , . . . ) , assume X is monotone increasing, show − X is monotone decreasing, where − X is defined by ( − X ) i = − ( X i ) . Bohua Zhan (MIT) AUTO2, a saturation-based heuristic prover August 23, 2016 8 / 27
A simple example Given an infinite sequence X = ( X 0 , X 1 , X 2 , . . . ) , assume X is monotone increasing, show − X is monotone decreasing, where − X is defined by ( − X ) i = − ( X i ) . In Isabelle: monotone_incr X = ⇒ monotone_decr ( − X ) . In contradiction form: [ monotone_incr X , ¬ monotone_decr ( − X )] = ⇒ False . Bohua Zhan (MIT) AUTO2, a saturation-based heuristic prover August 23, 2016 8 / 27
A simple example ¬ monotone_decr ( − X ) monotone_incr X Bohua Zhan (MIT) AUTO2, a saturation-based heuristic prover August 23, 2016 9 / 27
A simple example ¬ monotone_decr ( − X ) monotone_incr X ∀ m n . m ≤ n − → X m ≤ X n ¬∀ m n . m ≤ n − → ( − X ) n ≤ ( − X ) m Bohua Zhan (MIT) AUTO2, a saturation-based heuristic prover August 23, 2016 9 / 27
A simple example ¬ monotone_decr ( − X ) monotone_incr X ∀ m n . m ≤ n − → X m ≤ X n ¬∀ m n . m ≤ n − → ( − X ) n ≤ ( − X ) m m ≤ n ¬ ( − X ) n ≤ ( − X ) m Bohua Zhan (MIT) AUTO2, a saturation-based heuristic prover August 23, 2016 9 / 27
A simple example ¬ monotone_decr ( − X ) monotone_incr X ∀ m n . m ≤ n − → X m ≤ X n ¬∀ m n . m ≤ n − → ( − X ) n ≤ ( − X ) m m ≤ n ¬ ( − X ) n ≤ ( − X ) m X m ≤ X n Bohua Zhan (MIT) AUTO2, a saturation-based heuristic prover August 23, 2016 9 / 27
A simple example ¬ monotone_decr ( − X ) monotone_incr X ∀ m n . m ≤ n − → X m ≤ X n ¬∀ m n . m ≤ n − → ( − X ) n ≤ ( − X ) m m ≤ n ¬ ( − X ) n ≤ ( − X ) m X m ≤ X n ( − X ) m = − ( X m ) ( − X ) n = − ( X n ) Bohua Zhan (MIT) AUTO2, a saturation-based heuristic prover August 23, 2016 9 / 27
A simple example ¬ monotone_decr ( − X ) monotone_incr X ∀ m n . m ≤ n − → X m ≤ X n ¬∀ m n . m ≤ n − → ( − X ) n ≤ ( − X ) m m ≤ n ¬ ( − X ) n ≤ ( − X ) m X m ≤ X n ( − X ) m = − ( X m ) ( − X ) n = − ( X n ) ¬ X m ≤ X n Bohua Zhan (MIT) AUTO2, a saturation-based heuristic prover August 23, 2016 9 / 27
A simple example ¬ monotone_decr ( − X ) monotone_incr X ∀ m n . m ≤ n − → X m ≤ X n ¬∀ m n . m ≤ n − → ( − X ) n ≤ ( − X ) m m ≤ n ¬ ( − X ) n ≤ ( − X ) m X m ≤ X n ( − X ) m = − ( X m ) ( − X ) n = − ( X n ) ¬ X m ≤ X n False Bohua Zhan (MIT) AUTO2, a saturation-based heuristic prover August 23, 2016 9 / 27
Recommend
More recommend
